SCS-C02 Threat Detection and Incident Response Practice Test 11 — 15 Questions

Question 1

During a security incident, a forensic investigator needs to capture the memory of a running EC2 instance without shutting it down. Which AWS feature should be used?

Accepted Answer

EC2 Rescue for Linux or Systems Manager Run Command with a memory dump script. EC2 Rescue for Linux (via Systems Manager Run Command) includes a built-in script that can capture a full memory dump from a running EC2 instance without requiring a shutdown. This is essential for forensic analysis to preserve volatile data like running processes, network connections, and kernel structures. The script leverages the Linux 'vmcore' or 'LiME' (Linux Memory Extractor) tool to safely extract memory contents while the instance remains operational.

Answer

Amazon CloudWatch agent

Answer

AWS CloudTrail

Answer

Amazon EBS snapshot

Question 2

A company has a multi-account strategy and wants to ensure that all API calls from member accounts are logged to a centralized S3 bucket in the security account. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that logs all accounts. AWS Organizations allows you to create an organization trail in the management account that automatically applies to all member accounts. This ensures that CloudTrail logs from every account in the organization are delivered to a single, centralized S3 bucket in the security account without needing per-account configuration. The organization trail uses the management account’s CloudTrail configuration to enable logging across the entire organization, and the S3 bucket policy must grant the necessary permissions for CloudTrail to write logs from all accounts.

Answer

Use Amazon Kinesis Data Streams to stream CloudTrail events from all accounts to the central S3 bucket

Answer

Create a CloudTrail trail in each member account and specify the same S3 bucket

Answer

Enable AWS Security Hub in the security account and configure it to collect CloudTrail logs

Question 3

A security team detects that an IAM user's access keys are being used from an unusual geographic location. Which AWS service provides this type of anomaly detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including anomalous API calls from unusual geographic locations. It uses machine learning models and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, making it the correct service for detecting IAM user access key usage from an unexpected region.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 4

A security engineer is investigating a potential data exfiltration incident where an attacker used a compromised EC2 instance to transfer data to an external IP. Which TWO AWS services can provide evidence of the network traffic and the API calls made from the instance?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces, including the source/destination IP, ports, protocol, and packet/byte counts. This provides direct evidence of data being transferred to an external IP address from the compromised EC2 instance. AWS CloudTrail records API calls made within the AWS environment, such as those executed by the EC2 instance's IAM role or the instance itself (e.g., via the AWS CLI or SDK), which can reveal actions like starting data transfers or modifying security groups to allow exfiltration.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 5

A company uses AWS Organizations and wants to implement a centralized incident response process. Which THREE steps should be taken to ensure that security teams can respond to incidents across all accounts effectively?

Accepted Answer

Create IAM roles in each member account that grant incident responders cross-account access from the security account. Creating IAM roles in each member account with trust policies that allow the security account's incident responders to assume those roles enables centralized, cross-account access for incident response. This follows the principle of least privilege and allows the security team to perform actions (e.g., stopping instances, collecting forensic data) in any affected account without needing separate credentials or direct logins.

Answer

Set up AWS Systems Manager Incident Manager in each account independently

Answer

Create a single CloudTrail trail in the management account to log events from all accounts

Question 6

A security engineer needs to detect and respond to suspicious activity on an Amazon RDS database. Which TWO services can be used together to monitor database activity and trigger automated remediation?

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered by Amazon RDS database activity streams (e.g., via Amazon RDS for MySQL or PostgreSQL) or by Amazon CloudWatch Events/EventBridge rules that detect suspicious database events (such as failed login attempts or unusual query patterns). Lambda functions can then execute automated remediation actions, such as revoking database access, rotating credentials, or isolating the database instance. This enables a serverless, event-driven response to threats without manual intervention.

Answer

Amazon Detective

Answer

Amazon RDS Enhanced Monitoring

Answer

Amazon RDS Performance Insights

Question 7

The above IAM policy is attached to an AWS Lambda function. The function is failing to write logs to CloudWatch Logs. What is the likely cause?

Accepted Answer

The resource ARN does not include the log group itself; only log streams. The IAM policy grants `logs:CreateLogStream` and `logs:PutLogEvents` with a resource ARN that correctly targets log streams under the specified log group. However, the policy lacks any statement that grants permission on the log group resource itself. If the log group does not already exist, the Lambda function requires `logs:CreateLogGroup` permission on the log group ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup`) to create it. Without this, the function cannot create the log group, causing the write to fail. The resource ARN in the policy does not include the log group itself, only log streams, which is why the function lacks the necessary permissions to interact with the log group resource.

Answer

The actions list does not include logs:DescribeLogGroups

Answer

The policy is missing an explicit deny for other actions

Answer

The region in the ARN does not match the Lambda function's region

Question 8

A security engineer runs the above AWS CLI command to search for CreateKey events in CloudTrail. The command returns no events, but the security engineer knows that a KMS key was created in us-east-1 on January 1, 2023. What is the most likely reason for the empty result?

Accepted Answer

The CloudTrail trail is not multi-region and is configured in a different region. CloudTrail trails are region-specific by default. If the trail is configured only in a region other than us-east-1, it will not capture events from us-east-1, even if the security engineer is running the command from us-east-1. A multi-region trail must be explicitly enabled to log events from all AWS regions, including us-east-1.

Answer

The event name is incorrect; the correct event is 'CreateKey' but it is case-sensitive

Answer

The user does not have permission to view KMS events in CloudTrail

Answer

The time range specified is outside the retention period of CloudTrail

Question 9

A security engineer is investigating a potential compromise of an EC2 instance. The engineer needs to capture network traffic to and from the instance for forensic analysis. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring captures and inspects network traffic at the Elastic Network Interface (ENI) level by copying packets from a source ENI to a target, such as a Network Load Balancer or another ENI. This allows the security engineer to perform deep packet inspection and forensic analysis without impacting the production traffic flow. It supports both IPv4 and IPv6 traffic and can filter by protocol, port, or packet direction, making it ideal for incident response scenarios.

Answer

AWS Config

Answer

AWS Network Firewall

Answer

Amazon Inspector

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to automatically receive alerts when an IAM user attempts to access resources they do not have permissions for, across all accounts. Which combination of services should be used?

Accepted Answer

Amazon GuardDuty and AWS Security Hub. Amazon GuardDuty continuously monitors for suspicious activity, including unauthorized API calls or failed access attempts, across all accounts in an AWS Organization. Security Hub aggregates these findings from GuardDuty and other services, enabling automated alerts via integrations like Amazon SNS or AWS Chatbot. Together, they provide a centralized, cross-account threat detection and alerting solution that meets the requirement of notifying the security team when IAM users attempt unauthorized resource access.

Answer

Amazon Inspector and AWS Lambda

Answer

AWS Config and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 11

During an incident response, a security engineer needs to collect volatile memory from a compromised EC2 instance without affecting the running system. The instance is critical and cannot be stopped. Which approach is most appropriate?

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture utility.. AWS Systems Manager Run Command allows you to execute a memory capture utility (such as WinPmem or LiME) on the EC2 instance without stopping it, preserving volatile memory for forensic analysis. This approach uses the SSM Agent to run commands remotely, minimizing impact on the running system while collecting critical evidence like running processes, network connections, and kernel data.

Answer

Stop the instance, detach the root volume, and attach it to a forensics instance for analysis.

Answer

Use AWS License Manager to create a snapshot of the instance memory.

Answer

Use Amazon EC2 Rescue to collect memory dump.

Question 12

A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer has enabled S3 server access logs and CloudTrail data events. Which log source would provide the most granular details about the request, including the requester's IP address and user agent?

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester's IP address, user agent, request URI, HTTP status, and error codes. This granularity makes them the best source for investigating data exfiltration, as they capture per-request metadata that CloudTrail data events and VPC Flow Logs do not.

Answer

VPC Flow Logs

Answer

AWS CloudTrail data events

Answer

Amazon CloudWatch Logs

Question 13

A company needs to ensure that all API calls in their AWS account are logged and monitored for suspicious activity. Which service should be enabled first?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct first service to enable because it records all API calls made in the AWS account, including the identity, source IP, and timestamp of each call. This audit log is foundational for detecting suspicious activity, as it provides the raw data needed for analysis by other services like Amazon GuardDuty or third-party tools. Without CloudTrail, there is no record of API activity to monitor.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 14

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to quickly block all traffic to that IP while preserving the instance for forensic analysis. Which approach is the most effective?

Accepted Answer

Add a network ACL rule to deny outbound traffic from the instance's subnet to the malicious IP.. Modifying the network ACL to deny outbound traffic to the malicious IP is the most effective approach. Network ACLs are stateless and can explicitly deny traffic, applying at the subnet level. This blocks the traffic immediately while preserving the instance for forensic analysis, as it does not require stopping the instance or affecting its state.

Answer

Stop the instance immediately.

Answer

Modify the instance's security group to deny outbound traffic to the malicious IP.

Answer

Modify the route table to route traffic to the malicious IP to a blackhole.

Question 15

Which TWO AWS services can be used to detect anomalous behavior in an AWS environment?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing VPC Flow Logs, AWS CloudTrail management and data events, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to identify unexpected traffic patterns, such as cryptocurrency mining activity or unusual API calls, making it a primary service for detecting anomalous behavior.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector